Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.rc > #324107 > unrolled thread
| Started by | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| First post | 2022-07-29 23:00 +0200 |
| Last post | 2022-08-14 18:00 +0200 |
| Articles | 5 — 2 participants |
Back to article view | Back to linux.debian.bugs.rc
Bug#1016351: dovecot: CVE-2022-30550 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-29 23:00 +0200
Processed: Re: Bug#1016351: dovecot: CVE-2022-30550 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-30 00:30 +0200
Bug#1016351: dovecot: CVE-2022-30550 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-30 20:20 +0200
Bug#1016351: marked as done (dovecot: CVE-2022-30550) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-31 18:00 +0200
Bug#1016351: marked as done (dovecot: CVE-2022-30550) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-08-14 18:00 +0200
| From | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| Date | 2022-07-29 23:00 +0200 |
| Subject | Bug#1016351: dovecot: CVE-2022-30550 |
| Message-ID | <EOFfr-eGp9-3@gated-at.bofh.it> |
Source: dovecot
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security
Hi,
The following vulnerability was published for dovecot.
CVE-2022-30550[0]:
| An issue was discovered in the auth component in Dovecot 2.2 and 2.3
| before 2.3.20. When two passdb configuration entries exist with the
| same driver and args settings, incorrect username_filter and mechanism
| settings can be applied to passdb definitions. These incorrectly
| applied settings can lead to an unintended security configuration and
| can permit privilege escalation in certain configurations. The
| documentation does not advise against the use of passdb definitions
| that have the same driver and args settings. One such configuration
| would be where an administrator wishes to use the same PAM
| configuration or passwd file for both normal and master users but use
| the username_filter setting to restrict which of the users is able to
| be a master user.
https://www.openwall.com/lists/oss-security/2022/07/06/9
https://github.com/dovecot/core/commit/7bad6a24160e34bce8f10e73dbbf9e5fbbcd1904
https://github.com/dovecot/core/commit/a1022072e2ce36f853873d910287f466165b184b
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-30550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30550
Please adjust the affected versions in the BTS as needed.
[toc] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2022-07-30 00:30 +0200 |
| Subject | Processed: Re: Bug#1016351: dovecot: CVE-2022-30550 |
| Message-ID | <EOGEx-eHlE-7@gated-at.bofh.it> |
| In reply to | #324107 |
Processing control commands: > tags -1 + pending Bug #1016351 [src:dovecot] dovecot: CVE-2022-30550 Added tag(s) pending. -- 1016351: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016351 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| Date | 2022-07-30 20:20 +0200 |
| Message-ID | <EOZe9-eSsI-1@gated-at.bofh.it> |
| In reply to | #324107 |
Am Fri, Jul 29, 2022 at 02:52:32PM -0700 schrieb Noah Meyerhans:
> My inclination is that this won't need a DSA and can wait for a bullseye point release,
Agreed! Marking it as such in the Debian Security Tracker.
Cheers,
Moritz
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2022-07-31 18:00 +0200 |
| Subject | Bug#1016351: marked as done (dovecot: CVE-2022-30550) |
| Message-ID | <EPjwd-f4rD-7@gated-at.bofh.it> |
| In reply to | #324107 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Sun, 31 Jul 2022 15:50:00 +0000 with message-id <E1oIBCa-001gA4-QI@fasolo.debian.org> and subject line Bug#1016351: fixed in dovecot 1:2.3.19.1+dfsg1-2 has caused the Debian Bug report #1016351, regarding dovecot: CVE-2022-30550 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1016351: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016351 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2022-08-14 18:00 +0200 |
| Subject | Bug#1016351: marked as done (dovecot: CVE-2022-30550) |
| Message-ID | <EUobT-yo6-21@gated-at.bofh.it> |
| In reply to | #324107 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Sun, 14 Aug 2022 15:47:08 +0000 with message-id <E1oNFpU-00BfTU-Ko@fasolo.debian.org> and subject line Bug#1016351: fixed in dovecot 1:2.3.13+dfsg1-2+deb11u1 has caused the Debian Bug report #1016351, regarding dovecot: CVE-2022-30550 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1016351: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016351 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.rc
csiph-web